Security Overview
TAPP is an edge monitoring system for industrial plants — boilers and steam systems, and the broader mix of critical and rotating equipment around them: chillers, tanks, motors, pumps, and water chemistry controllers. It reads equipment-health data and sends it to the cloud so plant operators get real-time visibility. Because it lives on the same site as critical equipment, security is not a feature bolted on afterward; it is the organizing principle of the design. Any equipment with a control system connects only to the protected side of the TAPP Gateway, a one-way data transfer gateway that carries equipment data outward and provides no reverse forwarding path back toward that equipment — and everything TAPP puts on your network is outbound-initiated, single-endpoint, and read-only.
This page is the one-page posture summary. Each area links to a detail page for depth.
Posture at a Glance
| Security Area | TAPP Posture |
|---|---|
| Control system isolation | One-way data transfer gateway (the TAPP Gateway); control systems isolated from the customer network and from the public internet |
| Data in transit | TLS encryption (MQTT over TLS to AWS IoT Core port 8883) |
| Data at rest | Stored in AWS (US region); encrypted at rest per AWS defaults |
| Network footprint | One device, one MAC address on customer network; all traffic outbound-initiated |
| Remote access | Tailscale (WireGuard VPN); outbound-initiated; no inbound firewall rule required |
| Data collected | Equipment performance telemetry only — no process recipes, no control logic, no PII |
| Sub-processors | AWS (IoT Core, S3, compute) |
The Pillars
Control system isolation. Control systems connect only to the protected side of the TAPP Gateway. Data is carried outward; nothing is carried back. This is a function of how the Gateway is built — the one-way path is established in hardware, not configured in software. See System Architecture.
Data & telemetry. TAPP collects equipment performance telemetry only — controller data, operational state, faults, and wireless sensor readings. No process recipes, no control logic, no personally identifiable information. See Data & Telemetry.
Network footprint. TAPP presents as a single device with one MAC address on your BMS VLAN. All traffic is outbound-initiated, so no inbound firewall rules are required. See Network Requirements.
Remote access. TAPP manages the Network Router over Tailscale (a WireGuard-based mesh VPN). The tunnel is outbound-initiated and terminates at the Network Router. There is no forwarding path from the Network Router across the TAPP Gateway to the protected side. See Remote Access.
Common questions. The Security FAQ pre-answers the questions a security reviewer is most likely to ask, in vendor self-assessment format.